# Hoot Lens client verification

Checked October 14, 2026. A listing, a configured server, approved account access and a completed investigation are different results.

| Client and route | Environment | Automated result | Limits |
| --- | --- | --- | --- |
| Codex CLI, remote anonymous demo | 0.162.0-alpha.17.2 on Windows x64 | One bounded invocation completed `list_projects`, `review_findings` and `get_session_narrative` in 16.19 seconds. | Synthetic Fieldnote only. No OAuth, local package, installation link, raw replay or embedded view checked. |
| Claude Community directory | Published listing | Discovery verified; a fresh client investigation is pending. | Provider health and metadata do not prove an investigation. |
| Cursor, VS Code and Cline | Documented setup routes | Current native client investigation pending. | Existing configuration tests are not native client proof. |
| ChatGPT | Private custom connection | Prior synthetic investigation, click map and replay checks passed. | Public submission remains in review; mobile and public catalog installation are unverified. |

The Codex invocation ignored user configuration, enabled only the Hoot Lens demo server and three read tools, used an empty workspace with a read-only sandbox, disabled web search and saved no client configuration or session. No Hoot Lens credential was supplied. A 120-second outer timeout bounded the process.

Its machine events contain three completed MCP calls, with no tool errors. The selected recording, `r_2ea01926eed0d9bc`, appears in the returned findings. Its narrative reports a misfire on the synthetic Copy install command at `offsetMs: 4826`. The final response identifies synthetic data and avoids claims of intent, cause or a proven fix. This is a limited first-result check, not a claim that the client completed OAuth or rendered a replay.

For the next named-client check, record the client version, operating system, exact route, granted scopes and tool-call evidence. Use the anonymous Fieldnote endpoint first. Test account sign-in separately with approved synthetic content, and keep credentials out of receipts. Do not replace a missing client check with SDK CI or check a marketplace testing attestation without the corresponding client evidence.